E55 Flasher VZ Rodeo and Saab 93

Programs / Tools / Scripts
ejukated
Posts: 443
Joined: Wed Mar 04, 2009 8:52 pm

Re: VZ E55 Flasher

Post by ejukated »

mattyjf01 wrote:If you can find a cvn for a module I'll look into it
Scantool CVNs
92190064, 4F74AD6E
92190926, C5A06A4B

Thanks!
mattyjf01
Posts: 282
Joined: Wed Sep 04, 2019 8:41 pm

Re: VZ E55 Flasher

Post by mattyjf01 »

ejukated wrote:
mattyjf01 wrote:If you can find a cvn for a module I'll look into it
Scantool CVNs
92190064, 4F74AD6E
92190926, C5A06A4B

Thanks!
CRC-32
User avatar
Tazzi
Posts: 3422
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: VZ E55 Flasher

Post by Tazzi »

ejukated wrote:I guess "virtual reading" is a 2 edge sword, if someones played with the cal to make the CVN look the same, then a virtual read wouldnt get the true file. Id be happy with just displaying the CVN, if its a common file - chances it will be available anyway.

Will take a closer look and see if i can get sample cvn and a file.
Thats the one, virtual reading.

If someones having to spoof the CVN, then to be honest its probably best to have a fresh calibrations to overwrite.

But could also compare the stock checksum as well, since there is the standard checksum and also CRC, its unlikely both have been spoofed due to the complexities of calculating correct CRC and then also making that match up with correct checksum.
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
mattyjf01
Posts: 282
Joined: Wed Sep 04, 2019 8:41 pm

Re: VZ E55 Flasher

Post by mattyjf01 »

Did a quick scan
Found MainOS CRC
But cant find Engine System CRC
ejukated
Posts: 443
Joined: Wed Mar 04, 2009 8:52 pm

Re: VZ E55 Flasher

Post by ejukated »

Tazzi wrote:
ejukated wrote:I guess "virtual reading" is a 2 edge sword, if someones played with the cal to make the CVN look the same, then a virtual read wouldnt get the true file. Id be happy with just displaying the CVN, if its a common file - chances it will be available anyway.

Will take a closer look and see if i can get sample cvn and a file.
Thats the one, virtual reading.

If someones having to spoof the CVN, then to be honest its probably best to have a fresh calibrations to overwrite.

But could also compare the stock checksum as well, since there is the standard checksum and also CRC, its unlikely both have been spoofed due to the complexities of calculating correct CRC and then also making that match up with correct checksum.
yeah good point. Do you know how the csum is calculated, we have flash ability, only thing missing to have an editor is the csum calculation to make some changes with the tools here.
mattyjf01
Posts: 282
Joined: Wed Sep 04, 2019 8:41 pm

Re: VZ E55 Flasher

Post by mattyjf01 »

Tech2 does a mode 9 PID 6 to get the CVN(CRC) of the MainOS (Module 1)
Without reading the Whole Calibration File and then doing a CRC, How else would you calculate CRC

What scantool are you using?
Can you log a cvn read?
User avatar
Tazzi
Posts: 3422
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: VZ E55 Flasher

Post by Tazzi »

mattyjf01 wrote:Tech2 does a mode 9 PID 6 to get the CVN(CRC) of the MainOS (Module 1)
Without reading the Whole Calibration File and then doing a CRC, How else would you calculate CRC

What scantool are you using?
Can you log a cvn read?
Tech2 will just be reporting the saved CVN in the flash.
You could manually pull this out from the memory locations just as you do when reading the flashout, which is also how reading the checksum can be done.

Checking both of these values from the flash memory (all of like.. 8bytes worth??) could be done in seconds.. and then compare them against stock files to validate its unedited. :thumbup:
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
ejukated
Posts: 443
Joined: Wed Mar 04, 2009 8:52 pm

Re: VZ E55 Flasher

Post by ejukated »

mattyjf01 wrote:Tech2 does a mode 9 PID 6 to get the CVN(CRC) of the MainOS (Module 1)
Without reading the Whole Calibration File and then doing a CRC, How else would you calculate CRC

What scantool are you using?
Can you log a cvn read?
I used the EFILive v2 scantool just because I had it handy, although i need to correct what i said before. In the EFILive scantool, Module 1 CVN appears correct, Module 2 & 3 are the same number and appear to be dummy numbers. The CVN for Module 2 in my original post above was shown in the HPTuners tune read but i suspect this is the CRC32 performed after the file is read rather than the CVN being specifically read out of the file.
mattyjf01
Posts: 282
Joined: Wed Sep 04, 2019 8:41 pm

Re: VZ E55 Flasher

Post by mattyjf01 »

ejukated wrote:
mattyjf01 wrote:Tech2 does a mode 9 PID 6 to get the CVN(CRC) of the MainOS (Module 1)
Without reading the Whole Calibration File and then doing a CRC, How else would you calculate CRC

What scantool are you using?
Can you log a cvn read?
I used the EFILive v2 scantool just because I had it handy, although i need to correct what i said before. In the EFILive scantool, Module 1 CVN appears correct, Module 2 & 3 are the same number and appear to be dummy numbers. The CVN for Module 2 in my original post above was shown in the HPTuners tune read but i suspect this is the CRC32 performed after the file is read rather than the CVN being specifically read out of the file.
That's what I thought
I'm not going to waste my time implementing that

Read just the calibration
Then use hexcmp
ejukated
Posts: 443
Joined: Wed Mar 04, 2009 8:52 pm

Re: VZ E55 Flasher

Post by ejukated »

mattyjf01 wrote:
ejukated wrote:
mattyjf01 wrote:Tech2 does a mode 9 PID 6 to get the CVN(CRC) of the MainOS (Module 1)
Without reading the Whole Calibration File and then doing a CRC, How else would you calculate CRC

What scantool are you using?
Can you log a cvn read?
I used the EFILive v2 scantool just because I had it handy, although i need to correct what i said before. In the EFILive scantool, Module 1 CVN appears correct, Module 2 & 3 are the same number and appear to be dummy numbers. The CVN for Module 2 in my original post above was shown in the HPTuners tune read but i suspect this is the CRC32 performed after the file is read rather than the CVN being specifically read out of the file.
That's what I thought
I'm not going to waste my time implementing that

Read just the calibration
Then use hexcmp
Yeah, no worries - thanks for looking into it :thumbup:
Post Reply